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BLL FRI INFORMATION CONTAINED 
HEREIN IS UNCLASSIFIED 


U.S. Department of Justice 


Federal Bureau of investigation 
Washington, D.C. 20535-0001 


Date: 10 May 2016 


Tos Priya Aiyer 
Acting General Counsel 
U.S. Department of the Treasury 


From: Peter strzolDy 
Section Chief 
Counterespionage Section 


Subject: Supplemental Classification Review and Determination 


Request 


{u//Feve) In July 2015, the FBI received a Section 811 referral 
from the Inspector General for the Intelligence Community (ICIG) 
regarding the possible compromise: of classified national security 
information. 


(U//BO86) The potential compromise was identified when, as part 
of a Freedom of Information Act (FOIA) request, the U.S. Department 
of State (DoS) and the ICIG reviewed electronic mail (email) 
communications from private email accounts previously used by a 
former Secretary of State during her tenure at DoS..An initial review 
of this material identified emails containing national security 
information later determined by the US Intelligence Community (USIC) 

to be classified up to the Top Secret /Sensitive Compartmented 
Information level. 


(U//PEe80) The FBI respectfully requests the U.S. Department of the 
Treasury (Treasury) conduct an official classification review and 
determination of the related documents contained on the accompanying 
DVD. This request is in addition to previous Classification Review 
and Requests submitted to your agency in October 2015, January 2016. 
While this request is separate from the previous requests, it should 
be responded to in similar manner. 


UNCLASSIFIED/ /Feuo 


This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 


HRC-10162 


UNCLASSIFIED/ /Feve— 


{U//FeG) The FBI understands you may also be reviewing 
materials as part of ongoing FOIA lawsuits involving some of these 
documents. This matter should remain separate from the FOIA matters) 
and information from this request should not be shared or co-mingled 
with the FOIA matter(s) to ensure the FBI’s investigation is not 
compromised or adversely affected. 


(U//FO80) The FBI also understands that DOS may have previously 
received similar, separate requests from other entities for an 
official classification review and determination for some or all of 
the documents contained on the enclosed DVD. In order to ensure 
consistency, the FBI requests DOS de-conflict its response to this 
FBI request with any previous classification determination Hee Ponees: 
related to these documents, and to provide the FBI the same 
classification determinations. The FBI requests DOS to. provide as 
soon as possible any previously rendered official classification 
determinations of documents related to this matter, to include any 
Classification determinations of documents related to the 
@clintonemail.com domain that are not contained on the attached DVD. 
The FBI requests DOS to provide classification determination 
responses to the FBI on a rolling basis as they become available. 


(U//Fese) Similar to the FBI’s previous requests, the enclosed 
DVDs contains a ReadMe.docx file, which provides an explanation of 
the files contained on the DVD. The DVDs also contain a Microsoft 
Excel spreadsheet titled Classification Review Response Tracker to 
assist your agency with tracking and responding to this 
classification review and determination request. The documents for 
review are listed in the FileList.xlsx spreadsheet and are contained 
in the Items folder. The Items folder is further explained in the 
aforementioned ReadMe.docx file. In the event DOS is aware of any 
equities belonging to other US Government agencies contained in 
documents provided as part of this request, the FBI requests DOS to 
identify those other US Government agencies in the “Notes” section of 
the enclosed spreadsheet. 


(U//Pe8@) The FBI may contact you in the future to ask you to 
- prioritize the review of certain items provided as part of this 
request. 


(U/ PES) - You are requested not to disclose the existence of 
this inquiry or the contents of the provided media, other than as 
necessary for compliance; disclosure may jeopardize the confidential © 
nature of the FBI’s investigation. 


UNCLASSIFIED / /Fove- 


This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 
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UNCLASSIFIED / /rote 


(U//PO8E}_Please direct all_inguiries regarding this request to 


b7C 


Section Chief 
Counterespionage Section 


oe 


UNCLASSIFIED / /reve 


This document contains neither recommendations nor conclusions of the FBI. [It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 
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FD-1057 (Rev. 5-8-10) 
FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


BS eatlars oaea rays wos By on 
wfer BY Syaryrsé syne 


Title: (U) Subfile Opening Document Date: 02/12/2 


From: CYBER 
DM-TOU 


Drafted By: 
: 
case 1 #:[ dds X/eey mrovzaR xan 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


b3 
b6 
b7C 
bTE 


Synopsis: (U//F®86} To open CYBER subfile 


assify On: 20411 


Details: 


Writer requests that a subfile be opened titled "CYBER", to store all 
Cyber investigative analysis. 


o¢ 


_SECRET//NOFORN- 
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DECLASSIFIED BY: NSICG caTw44R73 [ fecvpsr Sencar qa 
Ot 01-25-2018 
FD-1057 (Rev. 5-8-10) 
“SECRET/ ANeForr 
FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


Title: (U//PO8e) 1A Document fof Date: 03/24/2016 Bis 
Searches 
From: CHICAGO 
CG-CY-1 
b6 
b7C 
iD 
Case ID #: CYBES  (A/ AH) MIDYEAR EXAM; 
MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 
A . : b7E 
Synopsis: (U//FOUG@) Submits 1A document to the file fol | 
searches conducted in this investigation, 
Reference:[| __}cveer serial 13 bs 
b7E 
Enclosure(s}: Enclosed are the following items: 
b7E 


1. (0) [| search documentation. 


Details: 


(U//Pese) This communication submits to the file the 1A document 
that is associated with the above reference serial (13) in the CYBER 
sub file. 


“SEGRET / /HOFORIT 


HRC- 10199 


Title: 
Re: 


+4 


(U/ /FEOS 


_SECRET/ ANOFORN 


1A Document fo 
CYBER, 03/24/2016 


| SECRET / /NOFORN 


Searches 


‘, C-10200 


b3 
bTE 


b3 
bTE 


ALL INFORMATION CONTAINED 


HEREIN IS UNCLASSIFIZU UNCLASSIFIED/ /Fote 
DATE 01-25-2018 BY Ca7WA4H73 NSICS 


Physical 1A/iC Cover Sheet for Serial Export 


Created From: 


a a 


Serial 14 

Package: 1A10 

Stored Location: None 

Summary: (U//Fe8e) Documents 
provided b b6 
for searches b7¢ 
conducted in this b7E 
investigation. 

Acquired By: a 

Acquired On: 2016-03-24 


Attachment: 


(wf Jecaren 
documentation. 
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Eiectronic Communication 


Title: (U//FO¥6) Submit 1A Date: 05/18/2016 


From: WASHINGTON FIELD 
WEF-CI1i3 


b6 
b7¢ 
Drafted By| | 
WU 
ee EE ee 
MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 
Synopsis: (U//FO¥ey To submit to the file a 1A associated with seria 
62 of the sub OCA file. 
on: 1.4{c) 
Derived 
dated 2 
assify On: 204112 
erence: erila b7E 


Enclosure(s): Enclosed are the following items: 
1. (U//#680+- LHM submitted to USSS on 5/17/2016 


Details: 


(U/ APeSQ) =6This communication submits to the file a 1A associated 
with Serial 62 of the captioned case and subfile. 


+¢ 


"SEGRET/ /NOFORN 
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HEREIN IS UNCLASSIFIEU UNCLASSIFIED/ /Pese 
DATE 01-25-2018 HY C&87W44H73 ACS . 

pnysical 1A/1C Cover Sheet for Serial Export 


Created From: [Foca - 
OTE 


Serial 64 
Package: 1A40 
Stored Location: None 
Summary: (U//FO8Q) LHM submitted 
to USSS on 5/17/2016 
soquired ay: eae ss. 
Acquired On: 2016-05-17 
Attachment: (U//PECQ) LHM submitted 


to USSS on 5/17/2016 
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“SECRET / /NOFORN 
FEDERAL BUREAU OF INVESTIGATION 


Etectronic Communication 


Title: (U//P6¥01 Case Support Request Date: 11/09/2016 


From: CYS8ER 


b6 


BIC 


i eo 


Ti MISHANDLING OF CLASSIFIED; 
eye UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


LAW ENFORCEMENT _SENSEPIVE- 
This information is the proverty of the FRI and may be distributed to state, 
tribal, or local government law enforcement officials with a need-to-know. 
Further distribution without #BI authorization is prohibited. Precautions 
Shouid be taken to ensure this information is stored and/or cestroyed in a 
manner that precludes unauthorized access. 


Synopsis: (U//#686) WFO/CI-13 requests intrusion analysis of the 
identified 


son: 1.4{b} 
Derive 
NS5ISCc-200 
De sify On: 2041 


Details: 


* Indicates required information. 


it. (u/ /BeUa) General 


SECRET / AteFeRN 


HRC-10255 


: b3 
CYBER Serial 41 BIE 


“SECRET //NEFERN- 


Title: U Case Support Request 
Re: CYBER, 11/09/2016 ae 


D7E 


b7C 
phone #:;[___ 
1.1 *Reguest POC : 


‘E-mail Address: 


/ PRP Service Requested 


2.1 *Describe your goal or what you | 
want this support to provide, e.g., © 
list any information or questions 
you wish to specifically answer as a 
result of this review. 


' Review media provided for evidence 
‘of intrusion. 


2.2 *Specify any particular service ; 
or analysis you would like : N/A 
performed. 


/ AWPY Evidence or Material Format 


3.1 *I£ any material to be analyzed | 
is marked as or suspected to be 


en > Material is potentially up to 
classified, provide the 
ee : SECRET / /HGPERTT. 
classification level. Where ‘ AF 
suspected only, please explain. nip 
iM 


SECRET / /NOFORN- 


HRC- 10256 


[evs seria 41 


_ SECRET / /WOFORN 


Title: 


(U//PONG) Case Support Request 


Re:[ sR, 11/09/2016 


3.2 *Provide a complete list of 
evidence or material available for 
this review (e.g. hard drives and 
OS, portable media, tablet PCs, log 
files, malware). Please indicate if 
additional material is anticipated 


; Image of one hard drive from a 
:laptop computer. 


1 
4 


throughout the course of the review.: 


3.3 *Provide any specific handling 
or safeguards applicable to any 
material in this review. 


By default, contractor(s}) treat all 
information as Law Enforcement 
Sensitive (LES). 


4 


: Media is from a Sensitive 
‘Investigative Matter (SIM) involving 
a high level political figure. 
WFO/CI-13 is required to keep a list 
‘of all personnel with knowledge of 
ithis investigation and, therefore, 
‘requests a list of CyD personnel who 
work on this analysis. 


4. }§/A¥F) Case Background — 


4.1 Case Title 


4.2 *Short case summary/overview 


4.3 List any associated FBI cases. | 


4.4 *List any previous attempts or 
efforts to analyze this evidence. 


; Please contact case agent. 


HRC- 10257 


b3 
b7E 


b3 
b7E 


b3 
[ever serial a1 bTE 


“SECRET / ANOPORN 


Title: (U/ P6865 Case Support Request 


re: L__——S—~—~C~CSF CYBER, 11/09/2016 b3 
b7E 


4.5 *List any timing requirements 
such as expiration of search 
warrants, Geadlines set by DOJ, 
upcoming indictments, and so forth. 


Please contact case agent. 


4.6 *Of the materials to be i 
provided, specify the processing : 
priority (i.e. specific drives that 

are more important than others and | 
need analysis first). 


Single hard drive. 


4.7 *Are there limitations in the 

search warrant that restrict what ; Please contact case agent for a 
analysts can review? If so, please “COpy of the warrant. 

list search criteria. 


1 


5. (U/ /FOve} Field office Information 


5.1 Primary ‘Field Office ; WFO 


wm ewe reser manne, Pan rer 


5. ve Headquarters Program Manager DAD. Peter Strzok~ 


b6 
b7¢ 


3 *Primary Case Agent 


5.4 Additional Contact Information 


6. {Portion Mark) Additional Information: Use the section below to 
expand upon the answers provided above. Please identify the topic you 
are addressing when providing the additional details below. 


“SEORET/ /NOFeR 


HRC- 10258 


[ cvser serial 41 
“SBOREE/ /ROFORN- 


Title: (U//F686) Case Support Request 
re:[ sd CER, 11/09/2016 


+¢ 


SEGRET/ Avonmore 


iw 


HRC- 10259 


b3 
bTE 


b3 
bTE 


CECLASSISFIEC BY: NSISG CsTWw44R735 
OM O2-12-2013 : b3 
FID-1036 (Rev. 10-16-2009) 2 iy 
DSECRET/ AIOFORIN 
FEDERAL BUREAU OF INVESTIGATION 


Import Form 


Form Type: DEL-REX Date: 01/04/2017 


Title: (U//POtG? Cyber Division TAU Technical Analysis Report 


b7Cc 


Case ID ef fever Daye) MIDYEAR EXAM; 


__ MISHANDLING OF CLASSIFIED; 
iJ! UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U//Pede7 Analysis of computer intrusion or malware 
infection on a laptop hard drive belonging to Anthony Weiner. 


Derived Fr 
Secuxrj 
@classify On: 20421231 


+¢ 


SESRET/ /NOPERIT 


HRC- 10260 


CEC LASSIEIEC 
OM O2-12-2013 


0 


BY: NSICG C8TW44R75 


“SEGRET//NOFORNT 


G/INB The captioned investigation is highly sensitive and considered a prohibited 
investigation. Additionally, the investigation is — a SIM and has an exemption for 


uploading approved by AD Randall Coleman Serial 1). ee 
PS/ANE) To provide an electronic record, this document will serve as a placeholder within 

Sentinel so a document serial number can be assigned. The original document and any associated 

1A envelopes have been manually drafted and approved. The original approved and serialized 

documents are stored in a physical] case file. This case file is secured in a certified SCIF, located 

at FB] Headquarters, Roo and available for inspection upon request. Requests for ae 


inspection will need to be approved by the Assistant Director of Counterintelligence Division. 


“SEERET//NOFORH 


HRC- 10261 


ALL FBI INFORMATION CONTAINED 
HEREIN 18 UNCLASSIFIZU b3 
DATE 02-12-2018 BY Ca7w44H73 NSICG 302 Serial 103 a 
FD-1057 (Rev. 5-8-10) ope ec ere 
FEDERAL BUREAU OF INVESTIGATION 


Electronic Communication 


Title: (U//Fe86) To submit an FD-340 Date: 02/16/2017 


From: WASHINGTON FIELD 
WF-CI13 


b6 


BIC 


WU) 
eT ocr ee 


MISHANDLING OF CLASSIFIED; 
UNKNOWN SUBJECT OR COUNTRY; 
SENSITIVE INVESTIGATIVE MATTER (SIM) 


Synopsis: (U/ AFORBS This electronic communication (EC) is to document 
the submission of an FD-340 to file. 


ssify On: 204 


Reference:| «4d 302 Serial 102 b3 
bT7E 


Enclosure(s): Enclosed are the following items: 

1. (U//Fe883) Original notes re interview of Huma Abedin on 6 January 
2017. Associated Documents - Non-Disclosure Agreement, Emails 
displayed, and Notes 


Details: 


(U//Fere This electronic communication (EC) is to document the 
submission of an FD-340 to file. 


o4¢ 
“SECRET/ /NOFORIt 


HRC- 10262 


Co F302 serial 103 ba 
b7E 
SECRET/ /NOFORN 


Title: (U//PORS| To submit an FD-340 


re:[———S—S——=«*#d 3202, (02/16/2017 b3 
b7E 


SEGRED/ /NOTORN 


HRC- 10263 


ALL FAI INFORMATION CONTAINED 
HEREIN ITS ONOLASSISIEC 
CATE 02-12-2018 HY Catwa4h73 NSICG 


UNCLASSIFIED/ /Petcer 
Physical 1A/iC Cover Sheet for Serial Export 


Created From: a 


; b6 
Serial 103 — 
Package: 1A85 bIE 
Stored Location: None 
Summary : (U//FOee+ Original notes 


re interview of Huma 
Abedin on 6 January 


2017. 
Acquired By: 
Acquired On: 2017-01-06 
Acquired From: (U//FOCS} Huma Abedin 
Attachment: (U//PUG8} Original notes 


re interview of Huma 
Abedin on 6 January 
2017. Associated 
Documents - Non- 
Disclosure Agreement, 
Emails displayed, and 
Notes 
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CASE REFERRAL 


@ CORRESPONDENCES 


Tab |. “Date <) Fe *Deseription/Notés (8 th 


8/6/15 | W&Cc/DO) intent re: Voluntary Production 
8/7/15 | W&C/DOJ Revised Ltr re: Intent re: Voluntary Production/ Server Equipment 


8/10/15 | DOJ/W&C Voluntary Production/ Server Equipment/Limited Account 


4 8/31/15 | DOJ/W&C Cooperation/appearance 


fall 9/21/15 
9/22/15 | W&C/DO) 


8 9/24/15 | DOJ/Wilmer 


DOJ/Wilmer Agreement re: removal of Personal & Business files 


DOJ/W&C 


Post Voluntary Production/ Server Equipment 
Response to 9/2) W&C Letter 


Agreement re: voluntarily provided equipment &review of files 


oO 


9/25/15 | DOJ/WEC A. Attorney Client Privilege/Medical list/individuals, ete. 


B. Consent to Search 


9/29/15 | W&C/DO)J Response to 9/25/15 W&C letters/Filter 


11 9/30/15 | DOJ/BS&F Consent to access back-up files 


12 10/1/15 | W&Cc/DOJ A. Attorney Client Privilege /Medical list/individuals, etc. 
B. Consent to Search 


10/2/15 | DOI/WEC Response to 10/1/15 W&C letters/Filter 
10/4/15 | W&C/DOI Follow-up Ltr re: Summary on Voluntary Productions 
7:37 am 


15 10/4/15 | W&C/DO! Follow-up Ltr re: Agreements/ Production Stages/ 
7:39 am Addresses/Equipment 
10/5/15 | DOJ/Wilmer Turnover of equipment, securely deleted items and remaining files 
17 10/7/15 | DOJ/LaW Grant of Limited Consent to Take Possession of Personal Electronic 
information 


& 10/9/15 | W&C;L&W/DO) Correction of email address listed in Footnote 


19 | 10/14/15 | DOJ/W&C identifying equipment or devices that might contain or might have 
contained emails from 1/21/09 to 2/1/13 HRC-2865 


7 


Tab Lopate 7 ~" Description/Notes: 


10/ 16/ 15 DOJ/ W& Consent to search files dated 1/21/09 to 2/1/13 that may be located 
on equipment provided by the FBI 
10/16/15 ; DOJ/ Wilmer Emails produced. Equipment with 3 page summary attached 
10/28/15 | Wilmer/DO) Confirming receipt of spreadsheet and status of 30 emails 
23 | 10/28/15 | DOJ/ W&C Supplement to letter dated 9/25/15 concerning back-up files and 
consent to search 

24 11/9/15 WRC &L&W/DOI | Clarification of letter dated 10/4/15 

5 | 11/25/15 | DOJ/ Wilmer Per 9/10/15 agreement, voluntarily providing FB! w/1 WD HD 
6 | 12/14/15 | DO/Wilmer Back-up files relating to 2 BlackBerry devices not belonging to HC. 


2 


~! 


12/17/15 | Wilmer/DOJ Confirmation of marked files relating to 2 BlackBerry devices not 
belonging to HC ‘ 
1/8/16 | PWRWG/DO) Request for voluntary interviews 
1/11/16 | W&C/Wilmer Production of Retention Data from Copper (previously given to FBI 
on 9/24 & 10/5/15) . 


1/11/16 | WCPHD/DOJ Agreements made on 1/16/16 & 1/10/16 re: back-up copy of files 
retained my Cooper, Wilmer may transfer retention data under 
conditions 


31 1/11/16 | DOJ/Wilmer Per 9/10/15 agreement, voluntary providing to FBI SanDisk thumb 
drive; authorization to review Cooper materials 


NO 


1/11/16 | DOJ/Witmer W&C is maintaining retention data re: Cooper and assumes 
responsibility for responding to future DOJ request 
1/12/16 | DOJ /PWRWG Response to request for voluntary interviews of Mills and 
Samuelson 
1/12/16 | DOI/ PWRWG Response to request for voluntary interviews of Sullivan 
5 1/14/16 | PWRWG/DO) Clarity, defined scope and duration re: request for voluntary 
| interviews of Sullivan 
6 2/9/16 | W&C/DO} List of equipment or devices that may contain emails relating to 
email domain per FBI 


7 2/22/16 | DOJ/Wilmer Cooper item production & Kroll’s/Shred It’s process 


ia 
“ 


~HRC-2866 


=. Deseription/Notes 00 J 


ike CE DOI/WaIC ‘T Reeponss to SOPaTIE DO Ltr re devices & sauipment 

39 2/22/16 | DOJ/WE&C 2 Inquiries by DOJ re: W&C serial nos for laptops & Mero erete 
emails 

2/23/16 | DOJ/W&C iPad re: emails for 1/21/09-2/1/13 & forensic analysis 
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HRC- 2868 


HRC-2870 


~~ BRC-2872 


HRC-2874 


LAW OFFICES 


® WILLIAMS & CONNOLLY LLP 
| 725 TWELFTH STREET, N.W. 


DAVID E. KENDALL WASHINGTON, DB. C. 20005-5901 ese eT sina oie seae ieee 


(202) 434-5145 (202) 434-5000 
Ik s ‘ 
dkendall@we.com FAX (202) 434-5029 


August 31, 2015 


BY EMAIL AND FIRST CLASS MAIL 


b6 Per NSD 
i b7C Per NSD 
nited States Department of Justice 


National Security Division 
600 E Street, NW 
Washington, DC 20530 


b6 Per NSD 
@® -L_ ebereige 
As you may know, the former Secretary of State has repeatedly stated that 
she will cooperate with your inquiry in whatever way she can. Accordingly, she would be 
happy to appear voluntarily to answer questions, if that would be helpful in achieving as 
expeditious a resolution as possible, She does have scheduling commitments, but I’m 
sure we can work around those. e 


Sincerely, 


DavidlE, Kendall 


DEK/bb 


HRC-2875 


HRC-2876) 
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HRC-2880 


DAVID E. KENDALL 


LAW OFFICES 


WILLIAMS & CONNOLLY LLP 
725 TWELFTH STREET, N.W. 


WASHINGTON, D. C, 20005-5901 EDWARD BENNETT WILLIAMS G020-1968) 


(202) 434-5145 (202) 434-5000 
dkendall@we.com 
FAX (202) 434-5029 


September 21, 2015 


BY EMAIL AND FIRST CLASS MAIL 


—_ = Department of Justice 


National Security Division 
600 E Street, NW 
Washington, DC 20530 


On behalf of former Secretary of State Clinton, I want to reiterate our desire 
to facilitate the security inquiry we understand the Department is conducting at the behest 
of the Intelligence Community Inspector General into the storage of recently-classified e- 
mails at the hdr22@clintonemail.com address. 


As you know, shortly after this inquiry was ammounced, we voluntarily 
provided a thumb drive (and copies) and the server equipment which supported this email 
account during the Secretary’s tenure at the State Department. I also shared with you that 
the Secretary would voluntarily answer any questions you might have. Should you need 
to assess the successor server which for a time hosted this address and the successor 
hrod! 7@clintonemail.com address, we also would be happy to assist you in that regard,. 
consistent with maintaining the privacy of other e-mail accounts that are not part of your 


inquiry. ~ 


In short, we want to facilitate the efficiency of this security inquiry and look 
forward to learning from you if there are ways of which we can be of assistance. 


DEK/bb 


PAUL ®& CONNOLLY (1922-1976) 


b6 Per NSD 
b7C Per NSD 


b6 Per NSD 
b7C Per NSD 


HRC-2881 


HRC-2882 


ALL FRI INFORHATION CONTAINED 
HEREIN IS UNCLASSIFIED 
CATE 12-06-2016 BY I7851L8Tso NSICG 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


David E. Kendall, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


September 22, 2015 


Dear Mr. Kendall, 


We are in receipt of your letter dated September 21, 2015, which offers, among other things, access to 
what you have referred to as a “successor server” to the server equipment previously produced to the FBI 
on August 12, 2015. Based upon the FBI’s investigation, we understand that this “successor server” is in 

_ the custody of, and is being operated by, Platte River Networks and that it, at least for some time, 
contained emails to or from Secretary Clinton’s @clintonemail.com account. 


We are concerned that, notwithstanding your repeated statements in oral and written correspondence 
regarding your and your client’s willingness to cooperate in this matter, you had not raised the existence 
of the “successor server” or offered access to it prior ta your September 2) letter. We remind you that 
this server is covered by the preservation letters delivered ta Williams & Connolly LLP on July 31, 2015, 
and Platte River Networks on July 30, 2015, and we request that you ensure that this server remain 
operational with a continuous power source (i.¢., that it is not unplugged or its operation atherwise 
interrupted) until further notice. 


We also reiterate that the aforementioned preservation letters cover any other equipment or devices, 

whether or not previously disclosed, that contain or contained emails to or from the domain account 
@clintonemail.com, including all equipment related to the server voluntarily produced to the FBI on 

August 12; the “successor server” and al! related equipment, any other server and allrelated equipment 
that received or sent emails for this domain account; and all backup devices, including backup hardware 
purchased from or maintained by Datto, Inc. While we wiil seek to proceed in a mamer that causes the 

least amount of disruption to otherwise unrelated accounts and activities, we will take all necessary and 

’ appropriate steps to obtain any and all such equipment and items. . 


Sincere} 
b6 Per NSD 


b7C Per NSD 


_. co: Kenneth Eichner, Esq. 


HRC-2883 


HRC-2884 


HRC-2888 


} a 


__ERC-2892 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


BY EMAIL 


David E. Kendall, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


September 29, 2015 


Dear Mr. Kendall, 


This letter confirms receipt of two letters you sent me on September 25, 2015. Regarding your letter 
providing a list of individuals and entities with whom Secretary Clinton may have communicated in a 
privileged context, when deemed necessary we will be using a filter process to account for the possibility 
that records may contain privileged information. During the filter process, we will determine what 
privileges may apply and how best to identify privileged. information, utilizing as appropriate the list of 
individuals and entities you provided. . 


b6 per NSD 
b7C per NSD 


HRC-2893 


HRC-2894 


September 30, 2015 


VIA ELECTRONIC MAIL 


; b6 per NSD 
U.S. Department of Justice '  b7C per NSD 


National Security Division 
905 Pennsylvania Avenue, N.W. 
Washington, DC 20530 


b7C per NSD 
Pursuant to our conversation on September 29, 2015, this letter provides the Department of 


Justice consent to access the back-up files associated with Ms. Huma Abedin’s email account 
for the purpose of your security inquiry. 


We request that the historical email content from Ms. Abedin’s account dated February 2, 
2013 to the present be migrated to the new server and associated equipment acquired by 
Platte River Necworks in conjunction with your inquiry. 


Thank you for your consideragon. 


Very truly yours, 


HOPS 
\ os /s/ Karen L. Dunn 


Miguel E. Rodriguez Karen L. Dunn 

Bryan Cave LLP. . Boies, Schiller & Flexner LLP 
1155 F Street, NW 5301 Wisconsin Ave. NW 
Washington, DC 20004 Washington, DC 20015 


HRC-2895 
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LAW OFFICES 
WILLIAMS & CONNOLLY LLP 
725 TWELFTH STREET, N.W. 
DAVID E. KENDALL ‘ WASHINGTON, D. C. 20005-5901 EDWARD BENNETT WILLIAMS (1820-1988) 
: PAUL RL COWNOLLY (1922-1978) 
(202) 434-5145 (202) 434-5000 


dkendall@we.com 
FAX (202) 434-5029 


October 1, 2015 


BY EMAIL AND FIRST CLASS MAIL 


b6 per NSD 


U.S. Department of Justice b7C per NSD 


National Security Division 
905 Pennsylvania Avenue NW 
Washington, DC 20530 


ef 


| write regarding the Department of Justice’s security inquiry in response to a referral 
from the Inspector General of the Intelligence Community. Pursuant to our conversation, I 
understand that your security inquiry may involve review of Secretary Cl inton’s e-mails for 
evidence relevant to that inquiry. As discussed, her e-mails include materials covered by 
attorney-client, marital, or medical privileges. I provide the following list of individuals and 
entities with whom Secretary Clinton may have communicated in a privileged context. — 


Attorneys 
{———itians & Connolly LLP «6 per NSD 
illiams & Connolly LLP b7C per NSD 


David Kendall, Williams & Connolly LLP 
Utrecht, Kleinfeld, Fiori, Partners (f/k/a Ryan, Phillips, Utrecht & MacKinnon) 


aaa 
_ Cheryl Mills (in her capacity as personal counsel on prior matters) : : 
—a & Connolly LLP 
ogan Lovells 
atherine Turner, Williams & Connolly LLP 
Do seek, Kleinfeld, Fiori, Partners (f/k/a Ryan, Phillips, Utrecht & MacKinnon) 


Doctors 


b6 per NSD 
b7C per NSD 


HRC-2898 


WILLIAMS & CONNOLLY LLP 


- October 1, 2015 . b7C per NSD 
Page 2 


Marital 
President William Jefferson Clinton 


Personal Aides to President Clinton or former Secretary Clinton/Conduits of Marital 

Communications 
b6 per NSD 
b7C per NSD 


@ Personal 


b6 per NSD 
b7C per NSD 


Personal Financial Consultant 
' b6 per NSD 
b7C per NSD 


HRC-2899 


WILLIAMS & CONNOLLY LLP 
7 
October 1, 2015 b7C per NSD 
Page 3 


We request and anticipate that at the conclusion of your inquiry you will retum to us the 
- former Secretary’s non-federal record, personal e-mails. 


David Zeb 


e 


HRC-2900 


el 


HRC-2901 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


BY EMAIL 


David E. Kendall, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


October 2, 2015 


Dear Mr, Kendall, 


This letter confirms receipt of two letters you sent me on October |, 2015. Regarding your letter 
providing a list of individuals and entities with whom Secretary Clinton may have communicated in a 
privileged context, when deemed necessary we will be using a filter process to account for the possibility 
that records may contain privileged information. During the filter process, we will determine what 
privileges may apply and how best to identify privileged information, utilizing as appropriate the list of 
individuals and entities you provided. 


b6 per NSD 
b7C per NSD 
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ST 


HRC-2907 


oT 


HRC-2910 


Lt 


HRC-2915 


HRC-2918 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


David E. Kendall, Esq. 
Katherine M. Turner, Esq. . is 
Williams & Connoily LLP { 
725 Twelfth Street, N.W, 

Washington, DC 20005 


b6 per NSD 


Latham & Watkins LLP b7C per NSD 
555 Eleventh Street, N.W. | 
Suite 1000 . | 
Washington, DC 20004 


October 9, 2015 


Dear Mr. Kendall, Ms. Turner, anf sd b6 per NSD 


b7C per NSD 
In reference to my letter of October 4, 2015, I write to provide clarification of a minor factual error : : 
contained therein. The email address associated with the nam set forth in 


subparapraph 2 and footnote 3 on page 2 of the letter, was incorrectly provided as 
The correct email address for the account is 

i 

i 

H 

b6 per NSD 


b7C per NSD 


ce: Miguel E. Rodriguez, Esq.; 
Karen L. Dunn, Esq. 


’ 
Oe 


tpt 


laced shea tye ha 


yee an wm renee ha err He mest aman: oo 
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. 725 TWELFTH STREET, N.W. 


O76518TSO0 NSiIce 


DAVID E. KENDALL WASHINGTON, BD, C. 20005-5901 BD MuniHieTT WHAM sleaD “58 


(202) 434-5145 (202) 434-5000 
dall@we. 
Chepdal Pano FAX (202) 434-5029 


October 28, 2015 


BY E-MAIL 


U:S. Department : sli 


National Security Division 
905 Pennsylvania Avenue NW 
Washington, DC 20530 


De___ 


As discussed, this letter supplements my September 25, 2015 letter to you concerning the 
back-up files of former Secretary Clinton, and gives the Department of Justice consent to search, 
for evidence relevant to your security inquiry, all content contained in those back-up files. 


Further, we note that we provide this consent with the understanding that, as stated in 
your October 4, 2015 letter  __r me, all items voluntarily produced will be 
returned to the owners or disposed of consistent with FBI policies and procedures at the 
conclusion of the investigation. 


Sincerely, 


Uurd © fable 


David E. Kendal] 


b6 per NSD 
b7C per NSD 


b6 per NSD 
b7C per NSD 


b6 
b7C 


HRC-2934 
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HRC-2935 


U.S. Department of Justice 


National Security Division 


a A 
: Washington, D.C. 20530 


David E. Kendall, Esq. 
Katherine M. Turner, Esq. 
Williams & Connolly LLP 
725 Twelfth Street, N.W. 
Washington, DC 20005 


b6 per NSD 
Latham & Watkins LLP b7C per NSD 
555 Eleventh Street, N.W. i 
Suite 1000 : 
Washington, DC 20004 as 


November 9, 2015 - 


Dear Mr. Kendall, Ms. Turner, ad b6 per NSD 
: b7C per NSD 


In reference to my letter of October 4, 2015, ] write to provide clarification of an additional minor factual 
etror contained therein, The fetter stated in subparagraph 2 and footnote 3 on page 2 that all of the email 
content in certain accounts, with the exception of six (6) identified emails that may reside in the accounts, 
could be transferred to the New Server. These email a identified in the letter as 


eee raeceeenaie an account on th ain, As noted inm 
October 9, 2615 Jetter, the correct email address for the former account is 


The account_on th oma i 
For beth th n accounts, the identified emai 
actually appeared twelve (12), not six (6) times, and therefore when the content of these accounts was 


transferred to the New Server, all content was transferred with the exception of these twelve (12) emails. 


b6 per NSD 
b7C per NSD 


Sincerely, 
b6 per NSD 
b7C per NSD 


$ 


ec: Miguel E. Rodriguez, Esq.; 
Karen L. Dunn, Esq. 


et ene a ere saa yrme ee ei 
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b6 per FBI, NSD 
b7C per FBI, NSD 


@ >. é | vane 


December 14, 2015 


i = a 


Department of Justice 
Washington, D:C. 201530 


ar is ' b7C per NSD 


_ As you know, we previously reovidiel the FBI one Apple fea MacBook Pro iscigs computer, - 
Serial Number W89361H6644 (“MacBook Pro”), and one Apple brand MacBook Air laptop © 
computer, Serial Numbel MacBook Air’) (collectively, “laptops”), that . b6é 
belonged to Justin Cooper. We provided both laptops for the purposes of DOJ/F BI’s _ b7C 
investigation of Secretary Clinton’ § personal email accounts. 


. As agreed, at the: time of ‘ete dislivernt the laptops contained Mr. Cooper’s emails to and from 

Secretary Clintoti during her tenure as Secretary of State extracted from his email files. The 
laptops also contained back-up copies of a ee device.{or devices) that we understood 
@ Ueloners to Secretary Clinton. | 


As you know we have since detenined that a asia copy , a Blackberry device that 
remained on each of the MacBook Pro.and MacBook Air did not belong to Secretary Clinton. 
Those files were labeled as follows: 


- MacBook Pro, itent 4, filename BR BlackBerry Bold. 9900. ipd 
° ‘MacBook Aur, item. ne filename HR Blea Bold 9900.ipd 


ee we have discussed, we re ask: that you () remove all copies (digital and haid copy) of these two 
files from any U.S, government review cycle and that they not be reviewed, (2) destroy or” 
otherwise render thera inaccessible, and (3) send written confirmation of the same, Thank you 
‘for your attention to this matter. 


bé6é 
b7C 


Wilmer Cuser Pickering’ Hale and Dorr wr, 1875 Pennsylvania Avenue NW, Washington, DC 20006 _ 
Beijing Berlin Boston Brusseis Denver Frankfurt London Los Angeles = New York . Oxtord — Palo Alto . Washington 


HRC-2942 


Le 


HRC- 2943 


ALL FRI INFORMATION CONTAINED 
BEREIN IS UNCLASSIFIEG 
DATE 12-06-2016 BY J76018TsO NSicG 


’ 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


| ; : b6 
Wilmer Cutler Pickering Hale and Dorr LLP b7¢c 


1875 Pennsylvania Ave. N.W. 
Washington, DC 20006 


December $7, 2015 


“b7C 
This letter confirms receipt of the letter you sent me on December 15, 2055, identifying a back-up copy of 


a Blackberry device present on two computers produced to the Federal Bureau of Investigation (FBI) by 
Mr. Cooper that did not meet our agreed-upon criteria for production, As we have discussed, the FBI wilt 
mark the back-up files identified in your fetter such that, going forward, they wilt not be reviewed on any 
image of the materials that is in the possession of the FBI. 


b6 per NSD 
b7C per NSD 


HRC-2944 


87 


HRC-2945 


BY EMAIL 


Beth A. Wilkinson, Esq. 
Paul, Weiss, Rifkind, Wharton & Garrison LLP 
2001 K Street, NW 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


January 8, 2016 


Washington, DC 20006-1047 


Dear Ms, Wilkinson: 


I am writing to reiterate our previous request, which you have dectined thus far, to conduct 
voluntary interviews with your clients Cheryl Mills, Heather Samuelson, and Jake Sullivan. If 
you are willing to make these individuals available for voluntary interviews, please advise us as 


soon as possible. 


Sincerel : 
b6 per NSD 
b7C per NSD 


HRC-2946 | 


67 


HRC-2947 


ALL FBI INFGRZATION CONTAINED 
HEREIN IS UNCLASSIFIED 
DATE 12-06-2016 BY 3763918T80 NSIC 


WILMERHALE 
; b6 
January 11,2016. b7C 
David Kendall Esq. 
Katherine Turner, Esq. 
Williams & Connolly 
725 Twelfth Street, NW 
Washington, DC 20005 _ 
Dear Mr. Kendall and Ms. Turner: j 
As we have agreed, (1) today we are giving you certain data (hereinafter “retention data”)! from 
Justin Cooper’s Apple MacBook Air laptop and Apple MacBook Pro laptop that were provided 
to the FBI on September 24, 2015, and October 5, 2015, respectively, and (2) you will retain the 
retention data until such time that you reach an agreement with DOJ that the retention data no 
longer need be retained. 
DOJ may request that you provide files from the retention data as part of the DOJ/FBI security 
inquiry of Secretary Clinton’s personal email accounts. You have assumed responsibility for 
responding to any such future DOJ requests. We have made clear to DOJ that Mr. Cooper will 
not interpose any objection to DOJ possessing and reviewing files from the retention data that 
are responsive to such requests, and that Mr. Cooper has otherwise relinquished his ownership of 
and rights to the retention data. 
Best regards, 
b6 
b7C 
b6 per NSD 


b7C per NSD 


1 We have enclosed our letter agreement with DOJ specifying what constitutes “retention data.” 


Wilmer Cutler Pickering Hale and Dorr up, 1875 Pennsylvania Avenue NW, Washington, DC 20006 
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ee tte reall 


&LL FEI INFORMATION CONTATHNED 
BEREIN IS UNCLASSIFIEL 
CATE 12-06-2016 BY S7S8CisTso NsiIcc 


US. Department of Justice 


National Security Division 


i 
Washington, D.C. 20530 


January 11, 2016 


BY EMAIL 
: bé 
Wilmer Cutler Pickering Hale and Dorr LLP b7C 


1875 Pennsylvania Avenue, N.W. 
Washington, DC 20006 


Dear Mr, Zebley: 

As we agreed on January 6, 2016, WilmerHale (or other counsel, as later agreed between 
WilmerHale and DOJ) will maintain a back-up copy of all personal and business files present on 
the Mac Book Air (provided to the FBI on September 24, 2015) and, separately, the Mac Book 
Pro (provided to the FBI on October 5, 2015), whether or not retained by Mr. Cooper, 
containing: (1) any communications that include an @clintonemail.com email address; (2) any 
reference to the establishment or maintenance of the @clintonemail.com domain, including but 
not limited to references to any server(s) on which that emai] domain was maintained, stored, or 
operated; (3) any communications that include Bryan Pagliano; and (4) any communications that 
include an @state.gov email address dated December 1, 2008, or later (collectively “the retention 
data”). Mr. Cooper.and WilmerHale (or other counsel, as later agreed between WilmerHale and 
DOJ) need not retain back-up images of the MacBook Air and the MacBook Pro. 


As we discussed and agreed on January 10, 2016, WilmerHale may transfer the retention data to 
other counsel] on the conditions that (1) you provide me the name and contact information of the 
other counsel, and (2) the other counsel must agree to retain the retention data until such time 
that he/she reaches an agreement with DOJ that the retention data no longer need be retained. 


b6 per NSD 
b7C per NSD 
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ALL EBI INFCRHATION CONTAINED 
HEREIN IS UNCLASSIFIEL 
DATE 12-05-2016 BY 376318T80 NSICS 


WILMERHALE 
b6 
January 11, 2016 — 
b6 per NSD 
National Security Division b7C per NSD 
Department of Justice 


950 Pennsylvania Avenue, NW 
Washington, D.C. 20530 


By Ema [|] 
Deaf] 


As requested, Williams & Connolly (points of contact: David Kendall and Katherine Turner, 
(202-434-5000)) is maintaining all files that remained in our possession from Justin Cooper’s 
Apple MacBook Air laptop and Apple MacBook Pro laptop that meet the criteria set forth in 

your letter to us dated January 11, 2016 (hereinafter “retention data”). Williams & Connolly has — 
agreed to retain the retention data until such time that it reaches an agreement with DOJ that the 
retention data no longer need be retained. 


As the owner of the retention data, Williams & Connolly has assumed responsibility for 
responding to future DOJ requests made for the retention data in the DOJ/FBI security inquiry of 
Secretary Clinton’s personal email accounts. Mr. Cooper will not interpose any objection to 
DOJ possessing and reviewing files that are responsive to such requests, and has otherwise 
relinquished his ownership of and rights to the retention data. 


Best regards 


b6 
b7¢ 


Wilmer Cutler Pickering Hale and Dorr up, 1875 Pennsylvania Avenue NW, Washington, DC 20006 
Beijing Barlin Boston Brussels Denver Frankfurt London Los Angeles New York Palo Alta = Washington 
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,, TELEPHONE (202) 223-7300 


PAUL, WEISS, RIFKIND, WHARTON & GARRISON LLP UNIT 3801, OFFICE TOWER A, BELING 


2001 K STREET, NW WASHINGTON, DC 20006-1047 ess Gonce arn denerenace 


CHAOYANG DISTRICT 

BEWING 1oGoz0 

PEOPLE'S REPUBLIC OF CHINA 

TELEPHONE (65-101 5625-6300 

BETH 4. WILKINSON : . i 
12TH FLOOR, HONG KONG CLUA@ BuUILOING 

3A CHATER ROAC, CENTRAL 


. HONG KONG 
TELEPHONE (202) 223-7340 TELEPHONE (652) 2896-0300 


FACSIMILE {202) 204-7395 


ALDER CASTLE 

E-MAIL: bwilkinson@paulweiss.com 10 NOBLE STREET 
LONODN EG2¥ 74U, ULK. 
TELEPHONE (44 20) 7367 1600 


‘FUKOKU SEIME! BUILDING 
2-2 UCHIGAIWAICHD 2-CHOME 
CHIYODA-KU, TOKYO 100-CO1!, JAPAN 


January 12, 2016 TELEPHONE (B+3) 3507-B104 
TORONTO: DOMINION CENTRE 
77 KING STREET WEST, SUITE 3100 
P.O. 60x 226 


TORONTO, ONTARIO MSK 113 
TELEPHONE (416) 504-0520 


2001 K STREET, NW ° 


VIA Electronic Mail WASHINGTON, DC 20006-1047 


TELEPHONE (202) 223-7300 


$00 DELAWARE AVENUE, SUITE 200 
POST OFFICE @OX 32 b6 per NSD 


WILMINGTON, Of 19889-0032 b7Cc per NSD 
TELEPHONE (302) 655-4410 


Counterinteliigence and Export Control] Section 
National Security Division 
U.S. Department of Justice 


b7C per NSD 


I am writing on behalf of Chery] Mills and Heather Samuelson in response to your 
January 8, 2016 request that they submit to a voluntary interview. 


Ms. Millis and Ms. Samuelson serve as attorneys for Hillary Clinton. Accordingly, they 
each are bound by ethical rules and obligations not to discuss privileged or confidential 
information within the scope of their legal representation of former Secretary Clinton. 
See D.C, Rule of Professional Conduct 1.6. We therefore are not in a position to consent 
to a voluntary interview of either Ms. Mills or Ms. Samuelson. 


Sincerely, 


EA hh. // Fup 


Beth A. Wilkinson 
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PAUL, WEISS, RIFKIND, WHARTON & GARRISON LLP 


2001 K STREET, NW 
-_ TELEPHONE (202) 223-7300 


BETH 4. WILKINSON 


TELEPHONE {202} 223-7340 
FACSIMILE (202) 204-7325 


E-maiL: bwikinson@paulweiss.com 


| VIA Electronic Mail 


ounterintelligen 
National Security Division 
‘U.S. Department of Justice 


WASHINGTON, DC 20006-1047 


January 12, 2016 


ce and Export Control Section 


UNIT 3601. OFFICE TOWER A, BEIJING 
FORTUNE PLAZA 

NG. 7 BONGSANHUAN ZHONGLU 
CHAOYANG DISTRICT 

BEIJING 100020 

PEOPLE'S REPUBLIC OF CHINS 
TELEPHONE (86-101 5828-6300 


2TH FLOOR, HONG KONG CLUB BUILDING 
3A CHATER ROAD, CENTRAL 

HONG KONG ~ 

TELEPHONE (852) 2846-0300 


ALCER CASTLE 

10 NOBLE STREET 

LONDON EC2Y 7JU. U.K, 
TELEPHONE (44 20] 7367 1600 


1245 AVENUE OF THE AMERICAS 
NEW YORK, NEW YORK 10018-6064 
TELEPHONE {2)2)373-3¢C00 


FUKOKU SEIME!] BUILDING 

2-2 UCHIBAIWAICHG 2-CHOME 
CHIVOD4-KU, TOKYD 100:0D11, JAPAN 
TELEPHONE (61-3) 3597-8101 


TDRONTO-DOMINION CENTRE 

37 KING STREET WEST, SUITE 3100 
PO. BOX 226 

TORONTO, ONTARIO MSK 143 
TELEPHONE 1456) $04-0520 


SOO OELAWARE AVENUE, SUITE 200 b6 per NSD 
POST OFFICE BOX 32 : 
WILMINGTON, CE 19899-0032 b7C per NSD 


TELEPHONE (302) 655-4410 


b6 per NSD 
b7C per NSD 


@ ] am writing on behalf of Jake Sullivan in response to your January 8, 2016 request that 
he submit to a voluntary interview. 


y 


In light of our discussions with you to date about the parameters of such an interview, I 
cannot recommend to my client that he do so at this time. If you are able to clarify and 
define the scope and duration of the interview, we are certainly willing to further discuss 


your request. 


Sincerely, 


But tht Sf AYR 


Beth A. Wilkinson 


HRC-2959 


HRC-2960_-7 


U.S. Department of Justice 


National Security Division 


Washington, D.C. 20530 


January 14, 2016 


BY EMAIL 


Beth A. Wilkinson, Esq. 
. Paul, Weiss, Rifkind, Wharton & Garrison LLP 
2001 K Street, NW 

___ Washington, DC 20006-1047 


Dear Ms, Wilkinson: 


I am writing in response to your letter of January 12, 2016 in which you indicated your 
willingness to further discuss providing your client, Jake Sullivan, for a voluntary interview if 
the government was able to “clarify and define the scope and duration” of such an interview. 


In an effort to provide such clarification, we can inform you that the subject areas to be covered 
during the interview would be: Mr. Sullivan’s knowledge and understanding of the former 
Secretary’s use of a private email system; his knowledge of email communications regarding 
sensitive or classified information sent to and/or forwarded to the former Secretary; and his 
knowledge of the handling and transmission of classified information during his tenure at the 
State Department. Although it is only an estimate, we anticipate that an interview v of Mr. 
Sullivan would require approximately six hours, 


If you would like to discuss making Mr. Sullivan available for a voluntary interview, please 


advise us as soon as possible. 


Sincere} 
b6 per NSD 


b7C per NSD 
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ALL FBI INFORMATION CONTAINEL 
BERETN 15 UNCLASSIFIEC 
DATE 12-06-2016 BY G?6ELsTs0 NSICG 


WILMERHALE 
. bé6 
’ February 22, 2016 a 2.8 ; s. BIC 
. Department of Justice _ 
Washington, D.C. 20530 ; — ; , b6 per NSD 


b7C per NSD 


As you know, pursuant ‘to written agreements with you, Justin Cooper voluntarily provided the 


FBI with two laptop computers and certain other media, and Williams & Connolly i is retaining 
certain other data that was previously in Mr. Cooper’s possession. I write now to describe the 
status of hardware used to process data in connection with those productions and Williams & 
Comnally’s retention of data. 


Certain: data was penodioally saved io external drives in onder to seatch for, isolate, and/or save 
data for production or retention, Kroll Inc, (“Kroll”) has degaussed and shredded (using a third- 
party vendor called Shred It in Parsippany, New Jersey) all such externa} drives, except as 
follows: (1) drives. containing, retention data held by Williams & Connolly; (2) seven drives that 
were wiped and remain in WilmerhHale’s possession pending direction from you on a final 
disposition. (Note, Kroll also nega and shredded (using the same vendor) the drive known — 
as the Bi ca drive. ye 


Certain data was. processed: using standalone computers. At the eebeliion ofo our work on this 
matter, all data was wiped from those drives, the drives were removed from their machines, and . 
the drives were securely stoted pending diréction from you on a final disposition. WilmerHale i is. 
Agee two. of those drives, and Feolls is holding the RENE nine drives. 


| Please let me know ify you have any questions, 


‘bE 
b7c 


Wilmer Cutler Pickering Hale and Dorr up, 1875 Pennsylvania Avenue NW, Washington, DC 20006 
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UNITED STATES DEPARTMENT OF JUSTICE 
FEDERAL BUREAU OF INVESTIGATION 
Receipt for Property | ALL INFORMATION CONTAINED 


BEREIN IS UNCLASSIFIED 
Case ID: ; 
On (date) 0b] i j 20) b item (s) listed below were: 
Collected/Seized 


CATE 12-01-2016 BY J76018T80 WSICC 
Received From 


Returned To 


; Released To 
(Name) Hpl brepster 
(Street Address) [900 M Street NY, Soje 500 Westhing por, OC 20036 
(City) Wath pn , Qc : 
Description of Item (s): the / ) Lenovo Yoon. Z fro A Serie nombe Se ae 
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&LL FRI INFCORAATION CONTAINER 
HEREIN Is UNCLASSIFIED 
DATE 1l2-01-2016 By J7601LETSO NSICS 


W WILKINSON 


"1900 M STREET, NW 


WWW. WILKINSONWALSH.COM 
SUITE 800 a 
Rae ee W ESKOVITZ A LIMITED LIABILITY PARTNERSHIP 
WASHINGTON, D.C, |} LOS ANGELES 
June 10, 2016 
VIA Electronic Mail : 
bE Per NSC 
U.S. Department of Justice Die Fen Nee 


National Security Division 
950 Pennsylvania Avenue NW 


ee DC 20530 
ne b6 Per NSC 


b7C Per NSC 


This letter provides consent, in connection with the Department of Justice’s investigation 
into the use of a private server by former Secretary of State Hillary Clinton, to search the Lenovo 
Yoga 2 Pro (Serial ial —alihereatee “the Device’) belonging to my client, Heather b6 
Samuelson, who is Secretary Clinton’s attorney, pursuant to the terms described below. The — b7C 
Device is being provided to the Federal Bureau of Investigation (“FBI”) solely for the purposes of 
this Department of Justice investigation, and for the Department's use in connection with the 
investigation. In voluntarily providing the Device, Heather Samuelson, does not relinquish 
ownership or control over the Device, except for the FBI's limited investigative use as specified by . 
this agreement. The FBI does not assert custody and control over the Device or its contents for 
any other purpose, including any requests made pursuant to the Freedom of Information Act, 5 
U.S.C. § 552. 


1) You have confirmed that the sole purposes of the search are: (1) to search for any .pst 
files, or .ost files, or compressed files containing .pst or .ost files, that were created by 
Platte River Networks (“PRN”), after June 1, 2014 and before February 1, 2015, in 
response to requests for former Secretary Clinton’s e-mail from her tenure as Secretary 

of State, (hereinafter the “PRN Files”), including in an intact but deleted form; (2) to 
"attempt to identify any e-mails from, or remnants of, the PRN Files that could 
potentially be present on the Device; {3) to identify any e-mails resident on the Device 
sent to or received from the following e-mail accounts: hdr22@clintonemail.com; 
hrod17@clintonemail.com; hriS@att.blackberry.net; and 
hr15 @mycingular.blackberry.net (hereinafter the “Relevant Accounts”}, for the period 


fe 


HRC-2015 


of January 21, 2009 through February 1, 2013 (hereinafter the “Relevant Period”); and 
(4) to conduct a forensic analysis of the device to determine whether the Device was 
subject to intrusions or otherwise compromised. 


2) You have confirmed that Phase One of your search will proceed as follows: 

a. Your Technical Team (to include FBI technical personnel only}, will review the 
allocated space (i.e., active files) of the Device to search only for the PRN Files. 
Neither the Technical Team nor anyone else will review during Phase One the 
content of any .pst files, or .ost files, or compressed files containing .pst or .ost 
files that can be identified as created before June 1, 2014 or after January 31, 
2015. 

b. The Technical Team will review any files identified pursuant to subsection 2(a) 
above to determine whether they contain e-mails sent to or received from the 
Relevant Accounts during the Relevant Period. The files that do not include 
such e-mails will not be subject to any further review by anyone for any 
purpose, unless they meet the criteria identified in Phase Two or for purposes. 
of an intrusion analysis, both set forth below. 

c. The PRN Files that include e-mails sent to, or received by, the Relevant Accounts 
during the Relevant Period will be provided to a Filter Team, which will be 
limited to two attorneys, one FBI agent, and one FBI analyst, none of whom are 
members of the investigative team.? 

d. The Filter Team will review the contents of any file they receive from the 
process described in subsection 2(c) to identify and remove: (1) any privileged 
material; and (2) any material they can determine is not an e-mail sent to, or 
received by, the Relevant Accounts during the Relevant Period. 

e. You will notify us of the results of Phase One of the search before proceeding 
to Phase Two of the search. 

f. You will proceed to Phase Two of your search only in the event that the PRN 
File containing approximately 62,000 emails from the former Secretary's 
clintonemail.com account is not identified in the allocated space of the Device. 


3} You have confirmed that Phase Two of your search will proceed as follows: 

a. The Technical Team will search the Device, including the Device’s unallocated 

space, to identify any e-mails, fragments of e-mails, files, or fragments of files: 

(1} that include e-mails sent to, or received by, the e-mail addresses 
hdr22@clintonemail.com and hrod17@clintonemail.com during the Relevant 

Period or for which the date that the e-mail was sent or received cannot be 

_ determined; and (2) that include e-mails sent to, or received by, the e-mail 
addresses hr15@att.blackberry.net and hr1S@mycingular.blackberry.net that 


! Should there be an extremely large volume of materials tocated on the Device and provided to the Filter 


Team, we understand that the Department of Justice reserves the right to expand the number of Filter Team members 
in order to avoid significant delay in the review process. If such an expansion were necessary, the Oepartment of 
Justice has agreed to inform us of this change. 


-2- 
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can clearly be identified as having been sent to, or received by, those accounts 
during the Relevant Period.? Aside from the intrusion analysis described below, 
neither the Technical Team nor anyone else will search or review the Device for 
any other material or for any other purpose. ; 

b. The Technical Team will review the results of the foregoing searches for the 
purpose of removing any file or data that is not an e-mail or a fragment of an 
e-mail sent to, or received by, the Relevant Accounts during the Relevant 
Period. Aside from the intrusion analysis described below, such material will 
not be further reviewed by the Technical Team or anyone else for any other 
purpose. 

c. The remaining results of the search will be provided to the Filter Team, which 
will review those results to identify and remove: (1} any privileged material; (2) 
any material that, upon further review, is determined not to be an e-mail sent 
to, or received by, the Relevant Accounts during the Relevant Period; and (3) 
any material that, upon further review, is determined not to be a work-related 
e-mail sent to, or received by, the e-mail account hrod17 @clintonemail.com. 
Aside from the intrusion analysis described below, such materiat will not be 
further reviewed by anyone for any purpose. 


4) You have confirmed. that you will also conduct a forensic analysis of the Device to 
determine whether the Device was subject to intrusions or otherwise compromised, 
without reviewing the content of any user created files, including .doc, .xls, .pdf, jpeg, 
or e-mails not captured in the aforementioned searches. 


As soon as the investigation is completed, and to the extent consistent with all FBI policies 
and applicable laws, including the Federal Records Act, the FBI will dispose of the Device and any 
printed or electronic materials resulting from your search. No part of this letter shall be read to 
imply the consent to retrieve from the Device any data other than the data described above or to 
conduct any search or review in any manner other than as described above. 


Sincerely, 


hie GI 


Beth A. Wilkinson 


2 If a large volume of e-malls from the hr15 @att.blackberry.net and hr15 @mycingular.blackberry.net accounts 


~ for which a send or receive date cannot clearly be determined -- are located, we understand that the Department 
of Justice reserves the right to discuss further with counsel any additional search efforts that could be undertaken to 
assess whether such e-mails were sent or received during the Relevant Period. The Department of Justice will not 
undertake any such search without prior discussions with counsel and an agreement with counsel as to the scope of, 
and procedures to be used during, that additional search. 
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W WILKINSON 


1900 M STREET, NW 


WWW. WILKINSONWALSH.COM 
SUITE 800 
ee eee W ESKOVITZ A LIMITED LIABILITY PARTNERSHIP 
WASHINGTON, D.C. | LOS ANGELES 
June 10, 2016 
VIA Electronic Mail 
b6 Per NSC 


: b7C Per NSC 
U.S. Department of Justice 


National Security Division 
950 Pennsylvania Avenue NW 


cies Z ma 
: b7C Per NSC 


This letter provides consent, in connection with the Department of Justice's investigation 
into the use of a private server by former Secretary of State Hillary Clinton, to search the Dell 
Latitude E6330 (Serial No (hereinafter “the Device”) belonging ta my client, Cheryl b6 
Mills, who is Secretary Clinton’s attorney, pursuant to the terms described below. The Device is Bie 
being provided to the Federal Bureau of investigation {“FB!”) solely for the purposes of this 
Department of Justice investigation, and for the Department's use in connection with the 
investigation. In voluntarily providing the Device, Cheryl Mills does not relinquish ownership or 
contral over the Device, except for the FBI’s limited investigative use as specified by this 
agreement. The FBI does not assert custody and control over the Device or its contents for any 


other purpose, including any requests made pursuant to the Freedom of information Act, 5 U.S.C. 
§ 552. 


1) You have confirmed that the sole purposes of the search are: (1) to search for any .pst 
files, or .ost files, or compressed files containing .pst'or .ost files, that were created by 
Platte River Networks (“PRN”), after June 1, 2014 and before February 1, 2015, in 
response to requests for former Secretary Clinton’s e-mail from her tenure as Secretary 
of State, (hereinafter the “PRN Files”), including in an intact but deleted form; (2) to 
attempt to identify any e-mails from, or remnants of, the PRN Files that could 
potentially be present on the Device; (3) to identify any e-mails resident on the Device 
sent to or received from the following e-mail accounts: hdr22@clintonemail.com; 
hrod17 @ctintonemail.com; hr15@att.blackberry.net; and 
hriS@mycingular.blackberry.net (hereinafter the “Relevant Accounts”), for the period 
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of January 21, 2009 through February 1, 2013 (hereinafter the “Relevant Period”); and 
(4) to conduct a forensic analysis of the device to determine whether the Device was 
subject to intrusions or otherwise compromised. 


2) You have confirmed that Phase One of your search will proceed as follows: 

a. Your Technical Team (to include FBI technical personnel only), will review the 
allocated space (i.e., active files) of the Device to search only for the PRN Files. 
Neither the Technical Team nor anyone else will review during Phase One the 
content of any -pst files, or .ost files, or compressed files containing .pst or .ost 
files that can be identified as created before June 1, 2014 or after January 31, 
2015. 

b. The Technical Team will review any files identified pursuant to subsection 2(a) 
above to determine whether they contain e-mails sent to or received from the 
Relevant Accounts during the Relevant Period. The files that do not include 
such e-mails will not be subject to any further review by anyone for any 
purpose, unless they meet the criteria identified in Phase Two or for purposes 
of an intrusion analysis, both set forth below. 

c. The PRN Files that include e-mails sent to, or received by, the Relevant Accounts 
during the Relevant Period will be provided to a Filter Team, which will be 
limited to two attorneys, one FBI agent, and one FBI analyst, none of whom are 
members of the investigative team. 

d. The Filter Team wil! review the contents of any file they receive from the 
process described in subsection 2(c) to identify and remove: (1) any privileged 
material; and (2) any material they can determine is not an e-mail sent to, or 
received by, the Relevant Accounts during the Relevant Period. 

e. You will notify us of the results of Phase One of the search before proceeding 
to Phase Two of the search. 

f. You will proceed to Phase Two of your search only in the event that the PRN 
File containing approximately 62,000 emails from the former Secretary’s 
clintonemail.com account is not identified in the allocated space of the Device. 


3) You have confirmed that Phase Two of your search wil! proceed as follows: 

a. The Technical Team will search the Device, including the Device’s unallocated 
space, to identify any e-mails, fragments of e-mails, files, or fragments of files: 
{1) that include e-mails sent to, or received by, the e-mail addresses 
hdr22@clintonemail.com and hrod17@clintonemail.com during the Relevant 
Period or for which the date that the e-mail! was sent or received cannot be 
determined; and (2) that include e-mails sent to, or received by, the e-mail * 
addresses hri5@att.blackberry.net and hr1S@mycingular.blackberry.net that 


7 Should there be an extremely large volume of materials located on the Device and provided to the Filter 


Team, we understand that the Department of Justice reserves the right to expand the number of Filter Team members 
in order to avoid significant delay in the review process. [f such an expansion were necessary, the Department of 
Justice has agreed to inform us of this change. 
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can clearly be identified as having been sent to, or received by, those accounts 
during the Relevant Period? Aside from the intrusion analysis described below, 
neither the Technical Team nor anyone else will search or review the Device for 
any other material or for any other purpose. 

b. The Technical Team will review the results of the foregoing searches for the 
purpose of removing any file or data that is not an e-mail or a fragrnent of an 
e-mail sent to, or received by, the Relevant Accounts during the Relevant 
Period. Aside from the intrusion analysis described below, such material will 
not be further reviewed by the Technical Team or anyone else for any other 
purpose. 

c. The remaining results of the search will be provided to the Filter Team, which 
will review those results to identify and remove: (1) any privileged material; (2) 
any material that, upon further review, is determined not to be an e-mail sent 
to, or received by, the Relevant Accounts during the Relevant Period; and (3) 
any material that, upon further review, is determined not to be a work-related 
e-mail sent to, or received by, the e-mail account hrod17@clintonemail.com. 
Aside from the intrusion analysis described below, such materia! will not be 
further reviewed by anyone for any purpose. 


4) You have confirmed that you will also conduct a forensic analysis of the Device to 
determine whether the Device was subject to intrusions or otherwise compromised, 
without reviewing the content of any user created files, including .doc, .xls, .pdf, jpeg, 
or é-mails not captured in the aforementioned searches. 


As soon as the investigation is completed, and to the extent consistent with all FBI policies 
and applicable laws, including the Federal Records Act, the FBI will dispose of the Device and any 
printed or electronic materials resulting from your search. No part of this letter shall be read to 
imply the consent to retrieve from the Device any data other than the data described above or to 
conduct any search or review in any manner other than as described above. 


Sincerely, 


| LL, 4 le 


Beth A. Wilkinson 


7 \f a large volume of e-mails from the hr15@att. blackberry.net and hr15@mycingular.blackberry.net accounts 


-- for which a send or receive date cannot clearly be determined — are located, we understand that the Department 
of Justice reserves the right to discuss further with counsel any additional search efforts that could be undertaken to 
assess whether such e-mails were sent or received during the Relevant Period. The Department of justice will not 
undertake any such search without prior discusstons with counsel and an agreement with counsel as to the scope of, 
and procedures to be used during, that additional search. ‘ 
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